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REMARKS 

Claim Objections 

Claim 23 has been amended as noted by the Examiner to correct the error in 
dependency. 

Claim Rejections 35 ILS.C. § 102 

Claims 1-9 and 12-30 have been rejected under 35 U.S.C. § 102(b) as being 
anticipated by Danielsen . In light of this rejection, independent claims 1 and 17 have been 
amended and independent claim 15 has been cancelled. 

Danielsen shows a pair of processors executing an identical program and receiving 
identical inputs. The processors compare their outputs at the conclusion of execution, which 
is presumably cyclic, to detect an error in the execution of one of the processors. The system 
of Danielsen is intended for use in an anti-lock braking system (ABS) and, thus, like the 
present invention, is executing a form of real-time control. 

Nevertheless, in contrast to the present invention, the Danielsen system appears to be 
monitoring a single, slowly changing variable (wheel speed) to deduce slippage. Because the 
change in this variable is much slower than the execution speed of the processor, each 
processor may independently receive and process the input data, as depicted in Figure 7 of 
Danielsen , with an expectation that the inputs and computed outputs will match. 

In contrast, the present invention contemplates a safety system having possibly 
hundreds of inputs, each which may change asynchronously to collectively define a state that 
can change extremely rapidly. In this environment it is unlikely that the two processors, 
separated from the I/O and each other by a network, would have exactly the same set of input 
data, at any point in the execution cycle, or produce the same output data. For this reason, the 
present invention forces identical inputs onto each processor by a buffering process in which 
one buffered copy of the input variables is collected and shared with the two processors 
before execution begins. See generally paragraph [0076] of the present application. 

The present claim 1 has been amended to capture this distinction. As a result, 
Danielsen does not teach "a buffer receiving a plurality of independent variables, 
asynchronously from I/O circuits connected to sensors" or a "coordination program," 
providing each of the first and second processing units with "copies of the input variables at a 
predetermined point in the execution cycle" as now expressly claimed. 
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It is believed that a person of ordinary skill in the art reviewing Danielsen would 
logically be led to the solution described in paragraph [0006] of the present application, that 
is, dealing with the large number of asynchronous variables by making a comparison at each 
instruction by cross-checking input values and output values on an instruction-by-instruction 
basis as is done in the prior art. This solution would further be suggested because of the 
perceived need in safety industrial control to perform more detailed cross-checking than is 
obtained by simple output comparison. 

This distinction underlies a second feature of the present invention embodied in 
independent claim 16, which is: the present invention provides not only a comparison of 
output values but also a comparison of intermediate values that are not output. This 
comparison is performed on a less frequent basis that the comparison of output values 
allowing a tradeoff between sensitivity in detecting errors and speed of execution. This 
comparison of intermediate values is not taught in Danielsen , which only teaches the 
comparison of output values. 

While the Examiner has noted that Danielsen teaches a comparison of values of 
internal variables, at col. 4, lines 23-41, this, in fact, describes the generation of key values 
which are used solely for the purpose of identifying the correct operation of the processors 
and are not intermediate values leading to the determination of output values as required by 
the present invention. Further, these key values of Danielsen are not compared to each other 
(as required by the claim 1) but stand independently to identify an error in one of the 
processors. Further, there is no indication that there are two rates of comparison undertaken 
in Danielsen . 

The method claim 17 corresponding to claim 1 has been amended in a manner similar 
to that of claim 1 and is believed to be allowable for the same reasons as described above 
with respect to claim 1. 
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In light of these remarks and amendments, it is believed th at claim s 1-8, 10-1 1, 13-14, 
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